Extending Active Directory Powershell

Extending Active Directory Powershell

Today, I am going to show how we can leverage the power of Powershell V2 and Active Directory Module, and easily write powerful, professional cmdlets (with help message, positional parameters, default prompting, error handling etc.) for AD.

Couple of weeks ago, one of my colleagues (Alexander Lash) introduced me to a cool feature in Powershell V2 called Advanced Functions, using which one can write full-blown cmdlets within a module natively in Powershell! I thought of experimenting with this feature a little bit and build some cmdlets that would extend the current functionality of AD cmdlets. The outcome of my experimentation is a new module called ActiveDirectoryExtension in which I and some of my team members are planning to add utility functions/cmdlets built using Active Directory Module cmdlets.

The first set of the cmdlets that I am publishing today is an extension of Get-ADUser, Get-ADGroup cmdlets that would support NT4 style account names (domain\username) and UPNs (UserPrincipalName ex: username@domain.com) as identity.

Here is some sample usage using my new set of cmdlets. I have prefixed all the nouns with “XAD” meaning eXtending AD.

Loading ActiveDirectoryExtension module

Run ActiveDirectoryExtensions.ps1 in a Powershell Console and import ActiveDirectoryExtensions module. Scroll below for complete script and download instructions.

Tips: Copy the above commands into your $PROFILE file, so that both ActiveDirectory and ActiveDirectoryExtension will always be loaded when you open a new Powershell console.

Sample commands using the new extension cmdlets

PS C:\> Get-XADUser administratorPS C:\> Get-XADUser fabrikam\administrator ## NT4 Style name. Should work for cross forest and cross domain scenarios too.PS C:\> Get-XDAUser administrator@fabrikam.com ## UPN. NOTE: UserPrincipalName must be set on the account for this to work. ## Should work for cross domain scenarios.

PS C:\> Get-XADComputer myMemberServer * ## Fetches all the attributes set on the computer object with identity myMemberServer.PS C:\> Get-XADComputer myMemberServer * | Out-SortADProperties ## Sorts and displays all the properties found in the object as string.

PS C:\> Get-PossibleLdapAttributes user ## Prints out all the Ldap Attributes that can be set on a user objectPS C:\> Get-PossibleLdapAttributes computer ## Prints out all the Ldap Attributes that can be set on a computer objectPS C:\> Get-PossibleLdapAttributes group ## Prints out all the Ldap Attributes that can be set on a group objectPS C:\> Get-PossibleLdapAttributes msDS-ManagedServiceAccount ## Prints out all the Ldap Attributes that can be set on a service account object

Script

Here is the complete script:

NOTE: This script is just for proof-of-concept and is not intended to be production quality.

## URL: http://blogs.msdn.com/adpowershell# NOTE: This script is just for proof-of-concept and is not intended to be production quality.#

new-module-nameActiveDirectoryExtension-scriptblock{

## Description: This function sorts all the properties found in a ADEntity and # writes it to the console as string.# Tested using: Windows 2008 R2 Beta.# functionOut-SortADProperties(){foreach($msADEin$input){$msADEProps=$msADE.PropertyNames|sortif($msADEProps-ne$null){foreach($msADEPropin$msADEProps){$msADEProp.ToString().PadRight(23)+": "+$msADE[$msADEProp]}}}}

## Description: This function lists all the Ldap attributes that can be set on # the specified objectClass.# Tested using: Windows 2008 R2 Beta.# functionGet-PossibleLdapAttributes(){Param([Parameter(Mandatory=$true,Position=0)][String]$ObjectClass)$rootDSE=Get-ADRootDSE$schemaObject=get-adobject-filter{ldapdisplayname-like$ObjectClass}-PropertiesmayContain,SystemMayContain,SubClassOf-searchbase$rootDSE.SchemaNamingContext$schemaObject.MayContain$schemaObject.SystemMayContainif($ObjectClass-ne"top"-and$schemaObject.SubClassOf-ne""-and$schemaObject.SubClassOf-ne$null){Get-PossibleLdapAttributes$schemaObject.SubClassOf}}

## Description: The following functions are an extension (or wrapper) over Get-ADUser, # Get-ADGroup, Get-ADComputer and Get-ADServiceAccount cmdlets.# In addition to all the accepted form of identities for Get-ADUser, this function# supports NT4 style names (ex: fabrikam\administrator) and UserPrincipalName - UPN (ex:# administrator@fabrikam.com)# NOTE: NT4 style names would work for cross-forest and cross-domain scenarios.# UPN names would work only for cross-domain scenarios.# Tested using: Windows 2008 R2 Beta.# functionGet-XADUser(){Param([Parameter(Mandatory=$true,Position=0,ValueFromPipeline=$true,HelpMessage="Identity of the User. NOTE: NT4 Style names such as: fabrikam\administrator and UPNs such as: administrator@fabrikam.com is acceptable")][Object]$Identity,[Parameter(Mandatory=$false,Position=1,HelpMessage="List of properties to fetch")][Object]$Properties)Get-XADPrincipal-Identity$Identity-ObjectType"ADUser"-Properties$Properties}

functionGet-XADGroup(){Param([Parameter(Mandatory=$true,Position=0,ValueFromPipeline=$true,HelpMessage="Identity of the Group. NOTE: NT4 Style names such as: fabrikam\administrators")][Object]$Identity,[Parameter(Mandatory=$false,Position=1,HelpMessage="List of properties to fetch")][Object]$Properties)Get-XADPrincipal-Identity$Identity-ObjectType"ADGroup"-Properties$Properties}

functionGet-XADComputer(){Param([Parameter(Mandatory=$true,Position=0,ValueFromPipeline=$true,HelpMessage="Identity of the Computer. NOTE: NT4 Style names such as: fabrikam\mymachine")][Object]$Identity,[Parameter(Mandatory=$false,Position=1,HelpMessage="List of properties to fetch")][Object]$Properties)Get-XADPrincipal-Identity$Identity-ObjectType"ADComputer"-Properties$Properties}

functionGet-XADServiceAccount(){Param([Parameter(Mandatory=$true,Position=0,ValueFromPipeline=$true,HelpMessage="Identity of the ServiceAccount. NOTE: NT4 Style names such as: fabrikam\svcacct1")][Object]$Identity,[Parameter(Mandatory=$false,Position=1,HelpMessage="List of properties to fetch")][Object]$Properties)Get-XADPrincipal-Identity$Identity-ObjectType"ADServiceAccount"-Properties$Properties}

Update:Brandon Shell pointed out that Powershell has dropped the term "Script Cmdlets" and instead call them as "Advanced Functions". I have updated my post accordingly. He also pointed out few improvements to the script in terms of performance and brevity. I have updated the script with those changes. Thanks Brandon!